Developer-platform updates without leaving the developer surface.

Product and platform changes that matter to builders: hosted triage, API access, docs, webhook delivery, and the Free-to-Pro onboarding path.

Current line

0.6.0-alpha

developer surface

Hosted path

Free -> Pro

active public funnel

Trial

14 days

Pro onboarding

Recent changes

What changed for builders.

This page stays focused on developer-facing changes. Use the full changelog for broader product history.

0.6.0-alphaDeveloper surface

MCP server, Claude Code plugin and clearer triage API errors

An MCP server at /api/mcp, authenticated with an API key, offers four tools: list_findings, get_finding, lookup_cve and write_disposition. Exceptions it requests are created pending until a person approves them in the app, and case moves that need approval are refused, so nothing is approved automatically.
The cveriskpilot-triage Claude Code plugin connects to that server for CISA SSVC triage and saves VEX-status dispositions to cases, with setup steps at /docs/claude-code-plugin. It does not import or export VEX documents.
POST /api/v1/triage answers 422 AI_REFUSAL when Claude or Gemini declines a request, and the batch route marks that finding for manual review. Both triage routes answer 503 AI_PROVIDER_UNAVAILABLE with Retry-After when an AI provider is out of credits or at capacity and no fallback answers.
Both triage routes validate request bodies against a schema and answer 400 with details naming each invalid field. A batch with any finding missing its title or cveIds is rejected as a whole with INVALID_FINDINGS before triage runs.

0.4.0-alphaDeveloper surface

Hosted funnel and API platform alignment

Free and Pro are now the active public path across developer surfaces.
Pro checkout starts first and supports the beta discount flow.
Docs, onboarding, and developer entrypoints now align with the 14-day Pro trial.

0.3.0-alphaDeveloper surface

API and org console hardening

API keys, usage, hosted triage, and org-scoped billing surfaces were unified.
Webhook delivery, auditability, and access-control groundwork expanded.
Developer docs were reorganized around live routes instead of placeholder surfaces.

0.2.0-alphaDeveloper surface

Pipeline and CLI workflow expansion

Pipeline scanning, CLI upload, and GitHub Action guidance shipped together.
Hosted triage workflows were connected to scanner ingestion and evidence outputs.
The developer platform gained a clearer path from local scan to hosted API usage.

Full history

Need the broader product changelog?

The main changelog includes platform-wide release history beyond the developer surface.

Open full changelog Start 14-day Pro trial

Developer guide Docs API keys Support

CVERiskPilot developer surface

MCP server, Claude Code plugin and clearer triage API errors

An MCP server at /api/mcp, authenticated with an API key, offers four tools: list_findings, get_finding, lookup_cve and write_disposition. Exceptions it requests are created pending until a person approves them in the app, and case moves that need approval are refused, so nothing is approved automatically.

The cveriskpilot-triage Claude Code plugin connects to that server for CISA SSVC triage and saves VEX-status dispositions to cases, with setup steps at /docs/claude-code-plugin. It does not import or export VEX documents.

POST /api/v1/triage answers 422 AI_REFUSAL when Claude or Gemini declines a request, and the batch route marks that finding for manual review. Both triage routes answer 503 AI_PROVIDER_UNAVAILABLE with Retry-After when an AI provider is out of credits or at capacity and no fallback answers.

Both triage routes validate request bodies against a schema and answer 400 with details naming each invalid field. A batch with any finding missing its title or cveIds is rejected as a whole with INVALID_FINDINGS before triage runs.